 (defn- system-permissions-granted-by-acls
   "Returns a set of permission keywords granted on the system target to the given sids by the given acls."
   [system-object-target sids acls]
-  (let [relevant-acls (filter #(-> % :system-object-identity :target (= system-object-target))
-                              acls)]
-    (set
-      (for [permission [:create :read :update :delete]
-            :when (some #(acl/acl-matches-sids-and-permission? sids (name permission) %)
-                        relevant-acls)]
-        permission))))
+  (collect-permissions (fn [acl permission]
+                         (and (= system-object-target (:target (:system-object-identity acl)))
+                              (acl/acl-matches-sids-and-permission? sids (name permission) acl)))
+                       acls))
 
 (defn get-system-permissions
   "Returns a map of the system object type to the set of permissions granted to the given username or user type."

    (cpv/validate-parameters
      :acl safe-params
      (concat cpv/common-validations
              [permitted-group-validation
               identity-type-validation
               group-permission-validation
               boolean-value-validation])
      type-errors))
  params)


   :provider :string
   :permitted-user :acl-permitted-user
   :group-permission :acl-group-permission})

(defmethod cp/parameter->condition :acl-identity-type
 [context concept-type param value options]
